Just wondering if this was a "Fat fingered" mistake or intentional... -J
-----Original Message----- From: Frank Pater [mailto:fpater@dca.net] Sent: Thursday, April 08, 2010 1:20 PM To: nanog@nanog.org Subject: Re: China prefix hijack
Hi,
We received BGPmon notifications for all of our prefixes as well. Not sure if it's relevant, but this is also announced upstream from us by 3491. Example:
==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 216.158.0.0/18: Update time: 2010-04-08 15:58 (UTC) Detected by #peers: 1 Detected prefix: 216.158.0.0/18 Announced by: AS23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation) Upstream AS: AS4134 (CHINANET-BACKBONE No.31,Jin-rong Street) ASpath: 39792 4134 23724 23724
-- Frank Pater DCANet http://www.dca.net voice: 888-4-DCANET (888-432-2638) fax: 302-426-6386
On Thu, Apr 08, 2010 at 12:39:57PM -0400, Chris McDonald wrote:
i think so yeah
AS 23724 is now announcing 63.218.188.0/22 which is historically announced by ASes: 3491. Time: Thu Apr 8 16:55:02 2010 GMT Observed path: 812 174 4134 23724 23724
On Thu, Apr 8, 2010 at 12:33 PM, Grzegorz Janoszka <Grzegorz@janoszka.pl>wrote:
Just half an hour ago China Telecom hijacked one of our prefixes:
Your prefix: X.Y.Z.0/19: Prefix Description: NETNAME Update time: 2010-04-08 15:58 (UTC) Detected by #peers: 1 Detected prefix: X.Y.Z.0/19 Announced by: AS23724 (CHINANET-IDC-BJ-AP IDC, China Telecommunications Corporation) Upstream AS: AS4134 (CHINANET-BACKBONE
No.31,Jin-rong Street)
ASpath: 39792 4134 23724 23724
Luckily it had to be limited as only one BGPmon peer saw it. Anyone else noticed it?
-- Grzegorz Janoszka